Privacy notice

Last updated 17 October 2026.

This notice explains what personal information we collect when you use xylis.co.uk, why, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018). The company named at the foot of every page is the controller of your information. Contact us using the details on our contact page.

What we collect

When you order: your name, email address, phone number and delivery address, what you ordered, and the time you confirmed you are 18 or over, buying for research use, and accept our terms.
When you pay: the name and reference that appear on our bank statement. We never see or store card details.
When you message us on WhatsApp or by email: what you send us.
To stop abuse: a scrambled (hashed) form of your internet address, kept with your order, so we can limit how many unpaid orders one connection can place.

Why we use it

To take, deliver and support your order (needed to perform our contract with you).
To keep accounting and tax records (a legal obligation).
To prevent fraud and misuse of the shop (our legitimate interests).

We do not use your information for marketing and we do not sell it.

Who we share it with

Royal Mail, to deliver your parcel (your name and address).
Cloudflare, which hosts this website and sends our emails.
Our bank, which processes the transfers you make.
Authorities, if the law requires us to.

Some of these providers may process data outside the UK. Where they do, they use safeguards approved under UK law.

How long we keep it

Order records are kept for six years after the end of the financial year in which the order was placed, because the law requires us to keep accounting records. Messages are kept for as long as needed to deal with your question and any follow-up.

Cookies and browser storage

We use only what the shop needs to work: a cookie that remembers you confirmed you are 18 or over, and browser storage that holds your basket. We do not use advertising or tracking cookies.

Your rights

You can ask for a copy of your information, ask us to correct it, delete it (unless we must keep it, for example for accounting records), restrict or object to how we use it, or receive it in a portable format. Contact us to do any of these; we reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.